Repository navigation
Persist person-approved Codex trust and scope API-profile quotas - #157
pepechka-kun wants to merge 18 commits into
Conversation
Isolated profiles could not save folder trust and showed misleading quota status. Use guarded host writes for trust, keep agent settings protected and bind quota data to the exact local provider account and profile.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 064a7b1596
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
064a7b1 to
58ae226
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58ae226820
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ows home Late-created backups could escape Linux mounts, and POSIX HOME could prevent Windows trust checks. Reserve private storage during startup and use the OS account home for Windows app-server launches.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 67ae6f85be
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…tarts A child held by an unverified parent could bypass the host trust check on Restart. Retain the restored parent dependency and refuse child restart until the parent has launched successfully.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14aa9da92b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…erver homes Running descendants bypassed folder trust when their root had exited, and an unusable Unix HOME broke an otherwise valid profile. Verify roots that own restored children and choose an existing absolute app-server working directory.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…cess launches Case aliases could make profile detection disagree with the spawned CLI. Normalize launch layers before inspection and spawning, and keep Unix launcher fixtures out of native Windows tests.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 361d508395
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
An existing Unix home could still reject chdir with EACCES. Verify execute/search access and choose the prepared profile when that home is unusable.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19768ff482
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Stopped contributed ancestors could not verify their profile, while wholly stopped trees were unnecessarily marked failed. Track ancestors of actual launches, hold unprepared roots with active descendants, and grant per-run folder trust only from a live root.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 848da50284
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Missing Windows profile aliases bypassed host trust, and non-Codex contributed parents could race restored children. Compare canonical profile identities by platform and finish ancestor preparation before descendants launch; cover success and failure paths.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e2e1b2f1b9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
An exited root could leave running descendants without exact-folder trust and stall them at startup. Hold affected descendants and intermediate Codex cards until the root restarts, regardless of its provider, while preserving finished history; test nested folders and mixed-provider trees.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc49d22b5a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Darwin paths were compared as case-sensitive even on insensitive volumes. Observe directory identity on the selected volume, use a cleaned empty-directory probe only at mount boundaries, and preserve case-sensitive distinctions; test real filesystem behavior and config preservation.
Case folding must not merge similarly named paths on separate macOS volumes. Include the observed filesystem device in each canonical profile identity.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4a63d94df0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Missing NFC and NFD profile spellings bypassed host trust on normalization-insensitive volumes. Normalize only components the actual filesystem resolves to the same directory, preserve distinct profiles, and test first trust plus probe cleanup in both forms.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7a4a1cfa8b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
OS-wide Windows case folding could conflate distinct NTFS profiles. Anchor existing directories by device/inode and apply observed case/Unicode lookup only to missing suffixes; prepare the selected profile before locking writes and reject stale paths after a rename. Cover case-sensitive directories and moved aliases.
Filesystem identifiers may exceed JavaScript integer precision. Read device and inode as bigint before composing the trust coordination key.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ac8d6eef7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
JavaScript case mapping could merge filesystem-distinct Unicode profiles, and holding an exited ancestor overwrote its saved status. Compare missing spellings in a private filesystem tree and retain the original exit code; cover native mappings, cleanup, and another restore after descendant removal.
No source changes. The unchanged Even G2 diagnostics test read its log before the scheduled write completed; upstream workflow reruns require repository administration rights. Our Windows profile and restoration tests passed.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f8137cca40
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Person creation and history could save trust before a policy rejected the session. Route policy-controlled create, restart and history through the prepared launch guard; avoid duplicate restore preflight and test allow, refuse and timeout through real IPC handlers.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1f2e8ead0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
A parent trust refusal incorrectly changed completed leaf history, and historical failed intermediates could block otherwise admitted descendants. Propagate holds only along planned launch paths and treat a failure as current only when that launch or guard ran; cover finished leaves and past failures.
1 participant
Superseded by #158, a smaller bugfix-only PR from current main. Optional features and workflow/security-policy changes from this proposal are not included in the replacement. This branch and discussion remain available for reference.
Isolated Codex profiles could not persist person-approved folder trust, and API profiles showed misleading quota errors. Save validated trust only after launch-policy admission through host-owned configuration writes while keeping agent configuration protection; resolve quota data only for the matching account/profile.
Share environment normalization and canonical profile identity with actual child launches, including new profiles, case-sensitive NTFS directories and the actual case/Unicode lookup semantics of macOS volumes. Existing directories are matched by filesystem identity; missing suffix aliases are compared using native lookup in a private temporary tree, without JavaScript case or Unicode folding. Use a verified app-server working directory and create protected backup storage before isolation. Restore ancestors before descendants, propagate failed preparation across providers, preserve completed leaves/trees and the original exit codes of held exited ancestors, and grant temporary folder trust only from a live root. Running local Codex descendants of stopped roots wait for a root restart, including nested folders and mixed-provider ancestry.
Validation: 165 folder-trust/exact-resume/restore/contributor/Auto-profile/history/policy tests passed. Latest full combined local check with #155 and #156: 2,355 passed, 27 skipped, no failures; typecheck and source secret audit passed. Platform selection and isolation arguments were tested locally on macOS; native Windows/Linux checks run in CI. No installed application, services, profiles or accounts changed.
Companion topics: #155 and #156; each is based independently on main.